HighCVECVE-2016-3081
[CVE-2016-3081] Apache Struts — Apache Struts Command Injection Vulnerability
CISA KEV·Source published ·1 min read
What happened?
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
Key details
- Citrix NetScaler ADC and Gateway have a memory buffer vulnerability allowing remote code execution or denial of service.
- Forensic triage is required per BOD 26-04 for affected systems.
- Organizations must apply vendor mitigations and follow CISA BOD 26-04 patching guidance.
- Running provided IOCs in the NetScaler console may help identify exploitation indicators.
- Stakeholders must evaluate internet exposure and adhere to BOD 26-04 patching guidelines.
Affected
- Citrix NetScaler ADC and NetScaler Gateway are affected.
Fixes and mitigations
- Apply mitigations per vendor instructions and CISA BOD 26-04 guidance.
What to look for
- IOCs provided for NetScaler console may indicate exploitation.
Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.